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Abstract 

We propose a definition for tlie information theoretic security of a quantum 
public-key encryption scheme, and present bit-oriented and two-bit-oriented 
encryption schemes satisfying our security definition via the introduction of 
a new pubhc-key algorithm structure. We extend the scheme to a multi-bit- 
oriented one, and conjecture that it is also information theoretically secure, 
depending directly on the structure of our new algorithm. 
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1. Introduction 

The public-key encryption schemes currently used will not keep their security 
in the post-quantum era, so it is necessary to find new kinds of encryption 
to resist the attacks of quantum adversaries. Quantum public-key encryp- 
tion (QPKE) is one solution, which has been studied for about ten years. 
Okamoto et al jl| put forward a knapsack-based scheme which involves a 
quantum algorithm during key generation. Gottesman and Chuang j2| were 
the first to use quantum states as public keys. Gottesman was also the 
first to put forward "Quantum Public Key Cryptography with Information- 
Theoretic Security" jsl based on Einstein-Podolsky-Rosen pairs. Yang j3] 
has discussed public-key encryption of quantum messages based on a classi- 
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cal computational complexity hypothesis. Kawachi et al [5|] investigated the 
cryptographic property "computational indistinguishability" of two quantum 
states generated via fully flipped permutations {QSCDjf), and gave a QPKE 
scheme based on this. Nikolopoulos suggested another scheme based on 
qubit rotations. The latter two schemes are bit-oriented, and Kawachi et al 
extended their scheme to multibits 0], which was later shown in [sj to have 
bounded information theoretic security. 

2. Security of Quantum Public-Key Encryption 

In classical public-key encryption (PKE), the ciphertext indistinguishability 
under a chosen plaintext attack (CPA) is defined as [9]: for every polynomial- 
size circuit family {Cn}, every positive polynomial p(-), all sufficiently large 
n, and every x,y in plaintext space,the probability Pr(-) satisfies: 

|Pr[C„(Gi(l"),EG.(i")(x)) = 1] -Pr[C„(Gi(l"),EG.(i")(l/)) = 1]| < (1) 

As the ciphertext is a quantum state in the quantum case, the cipher- 
text indistinguishability of QPKE is defined as the indistinguishability of 
any two quantum states in ciphertext space. Koshiba p^] extended indistin- 
guishability to QPKE, but he restricted the circuit to a polynomial-size one. 
We propose here a definition of ciphertext indistinguishability of quantum 
public-key encryption beyond the computational complexity hypothesis. 

Definition 1. A quantum public-key encryption has ciphertext indistinguisha- 
bility under CPA, if for every quantum circuit family {Cn}, for every positive 
polynomial p{-) , all sufficiently large n, and every x,y in plaintext space,the 
probability Pr(-) satisfies: 

|Pr[C.(Gi(l"),EG,(in)(x)) = 1] - Pr[C„(Gi(l"),EG,(i")(2/)) = 1]| < (2) 

where the encryption algorithm E is a quantum algorithm, and the ciphertexts 
E{x) and E{y) are quantum states. 

The difference between our definition and Koshiba's is that there is no 
restriction on {C„} in our definition. 
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According to |9l](see page 476), the definition we have presented here is 
related to information theoretic security under CPA. We define: A quantum 
pubhc-key encryption is information theoretically secure under CPA if it 
satisfies Eq. ([2]). 

In the following part, we give a quantum public- key encryption scheme 
which satisfies our definition of information theoretic security under CPA. 

3. A bit oriented Public-key Encryption Scheme 

Let: n„ = {/c G Z2^\ Wnik) is odd} and n„ = {A; G Z2n\ Wnik) is even}, 
where Wnik) is fc's Hamming weight. 

Definition 2. Define two n-qubit states: 

Ph = li\^) + \^®k)m + {i®k\), (3) 

and 

ph = ^i\^)-\^®k)){{t\-{i(Bk\), (4) 
where i G Z2n,k G fi„ . 



The two states p° ^ and pi ^ can be generated effectively as follows: 
For given i and k, use a permutation operator on \k), so that Pk\k) = 
1 ■ • ■ 10 ■ ■ ■ 0). Let Pk\i) = \i')\i")^ so: 



-^P,{\^) + \^ ® k)) = -L(|,')|r) + K©(2^-(^-)-l))K"©0)) 

= -^m + mn, (5) 

where \i') is the state after applying the X operation on each qubit of \i'). 

It can be seen that, + K')) is a Wnik) bits GHZ state. Inverting 

the above process, we obtain an effective way to generate p° ^ if GHZ states 
are available. 

To produce pl^, we just apply Z on each qubit of p^i Wni^k) odd. 
Then we have a polynomial-time quantum algorithm to convert p° j to p^ ^ 
without k and i. 
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Figure 1: First, Bob sends his public-key {s,p1^) to a public register. Alice gets Bob's 
public-key from the public register, then she encrypts b into p^. j, and sends {stp\^) back 
to Bob. 

3.1. Application in Quantum Public-Key Encryption 
Our quantum public-key encryption is shown in Figure [D 

[Key Generation] 

(Gl) Bob selects randomly a Boolean function F : fi„ — )■ as private key; 
(G2) Bob selects s E Qn randomly; 

(03) Bob generates p° j, where k = F{s), i is chosen randomly from ^2™; 

(04) Bob sends the classical-quantum pair (s, p° J to a public register as his 
public-key. 

When Alice needs to send a classical bit h to Bob via the quantum channel, 
they can do as follows: 

[Encryption] 

(El) Alice gets one of Bob's public keys from the public register; 
(E2) Alice encrypts h into j, then sends {s,p\ j) to Bob; 

[Decryption] 

(Dl) Bob receives (s,p^ J, and calculates k = F{s); 

(D2) Bob decrypts the one-bit message with k: (s, J — )■ b. 

Notes: 
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(1) The Boolean function F can be chosen from a larger set {0, 
but when s is chosen, it should satisfy F{s) G 

(2) The public register should ensure that Alice obtains the correct public- 
key from Bob. This is a precondition of all public-key encryption 
schemes. 

3.2. Trapdoor Property 

Bob can decrypt the cipertext states with k, but without i. So, we consider 
the mixed states: pl = ^Y.i Pk,i and pI = ^Y.i Pk,i- 



Lemma 3. For given k e there exists a polynomial-time quantum algo- 
rithm that distinguishes and pi determinedly. 

Proof: Let p be the unknown state p^ or pi, then the algorithm is given as 
follows: 

(1) Prepare two quantum registers, the first register holds a control bit in 
|0)(0|, and the second one holds p. After Hadamard's transformation 
is applied to the first register, the state of the system becomes: 

(2) Define Controlled- A; operator Ck as: Ck\0)\i) ^ \0)\i), Ck\l)\i) ^ 

k) for any i G (C^ can be realized via a group of CNOT operations), 
apply Cfe to the two registers, then the result will be 



_^ 2" — 1 

^ \'Pk,i)i'Pk,i\^ if P^pt (7) 



or 



i=0 



^ 2"-l 



where 



^ \'Pk,i){'Pk,i\: if P^ Pk: (8) 

i=0 



= c,[\(\o) + m\i) + \i®k))] 

= lmi\^) + \^®k)) + m^®k) + \^))], (9) 
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wh) = c,[\m + \m\^-v®k))] 

= \[\m^-v®k)) + \i){\t®k)-m. (10) 

(3) Apply Hadamard transformation to the first register again: 

(i/ ® /)!<,) = -^|0)(|z) + |z© A:)), (11) 



[H®I)\vl,) = ^\im-\i®k)). (12) 
If p = the final state is |0)(0| ® p°; if p = p^, the final state is 

It can be seen that we can distinguish p^and p\ with correct probability 
1 after measuring the first register. □ 

3.3. Security Proof 

If there exists an eavesdropper Eve between Alice and Bob, she may use two 
ways to attack the QPKE. One is to find information about fc; another is to 
distinguish between p° ^ and p\ ^ to eavesdrop the message. 

By measuring p° • or p^ Eve can get i oi i®k with the same probability 
1/2, but she cannot get both of them. For each ^ or p\ ^, i and s are 
chosen randomly, then k = F{s) is also random. Although Eve may get i(Bk 
with probability 1/2, she cannot obtain any information about k because 
she cannot get i at the same time. The security is the same as that of a 
one-time-pad in classical cryptography. 

If Eve has an effective algorithm to distinguish p° ■ and pi ^ with non- 
negligible probability without k and i, that means Eve can distinguish the 

mixed states: p°^^ = 2n-i.2n J2ken„ J2i Pk,v Pldd = 2"-i-2" X]fcef^„ Xli Pk,i- 
However, we have the following lemma: 

Lemma 4. The trace distance (defined as pJi]) between p°^^ and p\^^ is lyh^- 
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Proof: 



pidd - pidd - ^ I*) ® ^1 - 



(13) 



where Agdd is a matrix with 

^ . 1, Wnit) mod 2 Wh{j) mod 2 

^0, Wnii) mod2 = WHi3) mod2' ^ ' 

Applying an appropriate unitary operator to both sides of Aodd, we obtain 






1 • ■ 


■ 


1 


1 


•■ 


■ 1 








1 • ■ 


■ 


1 


1 


•■ 


■ 1 






'11" 


®(n-l) 


'01" 


1 1 




1 



A' 



For \A® B\ = \A\ (g) \B\ and tr{A ® B) = tr{A) x tr{B), we have: 

(n-l) 



tr\A'\ = tr 



1 1 
1 1 



X tr 



1 

1 



2", 



(15) 



(16) 



D{podd,pldd) = \tr 



^A 



4 1 



2 ■ 2 



2ji 



n-1 ■ 



(17) 
□ 



Theorem 5. The quantum public-key encryption given above satisfies the 
inequality so it has information theoretic security under CPA. 
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Proof: For every quantum circuit family {C„}, and every x,y & {0, 1}, 

pr[a(Gi(n,i5;G.(i")(x)) = i] = Pr[a(py = i] 



k.i 



k,i 

k,i 

k,i 

= Vv[CMm) = ^]- (18) 

If X and y are different, we consider the difference between and p\^^. 

Any quantum circuit family {C„} that distinguishes between quantum 
states Pq^^ and p\^^ can be regarded as distinguishing two probability distri- 
butions liPml and {g^} based on a positive operator-valued measure(POVM) 
{Em} Hfisl], where p„ = tr(C„(p°^^)Em) and = tr{Cn{pldd)Em) are the 
probability distributions of quantum measurement outcomes labeled by m. 
The maximum trace distance between {pm} and {qm} [H] over the whole set 
of POVMs determines the probability upper bound for distinguishing 
and pIm by {C„}, 

|Pr[C„(p°,,) = l]-Pr[C„(pL) = l]l 
^ ^ E l^^[^-(^n(pL) - Cn(pL))]l 

m 

= max D{pm,qm)- (19) 

{Sm} 



According to [11|, |14 



maxD(p^, g^) = L)(C„(p°^J, C„(p^^^)) < /^(p^^^, pl^) = (20) 

For any positive polynomial p{-), there exists a sufficiently large n so that 
Eq. (E]) is satisfied. □ 
Remark. Like the public-key encryption mentioned above, in js], 0] , the 
private-key vr and public-key p+ have a one-to-one correspondence, so the 
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public-key p+ can only be used t times, t = o{nlogn) [sj . Because vr contains 
0{nlogn)-hiis, its efficiency is no better than a one-time pad. In our scheme, 
the private-key F is about poly{n)-hits long, and it corresponds to a group of 
public-keys (s, where s and i are chosen randomly. As mentioned above, 
s is open but k = F{s) is hidden by the one-time key i, so the adversary 
cannot compute F. Our private-key can be reused 2*^'^"') times. 

If we change our scheme to one similar to that in jij, letting k be the 
private-key, the public-key, then using the method in Theorems 2.4 and 
3.1 of (sj, we can obtain following result: 

Theorem 6. // we fix the key pair at (p°, k), the key pair can only be used 
t times, t=o(n). 

Proof: We calculate Wi^^krr Yl,k (Pk ^ Pk) ® iPk)'^*)\\tr- For simphcity, we cal- 
culate II YlikP^k ® (Pfc)^* ~ {4^)^^^^\\tr and use the triangle inequality. 



I X 



p° = ^ E 2(i^)(^i + ® ^1) = ^ E E ® ^^D' (21) 

i 

where x G {0, 1}. Thus we have 



2*^ 

k 



2n-l . 


2"* 


1 




2"-i ■ 


2nt 


1 




2n-l . 


2nt 


1 




2n-l . 


2nt 




V 2"^ 


-t ' 



k ii,--- ,it xi,--- ,xt 



k ii,--- ,it ^i."- ,xt 

(xi,.-,:ct)5^(0,--,0) 



\tr 



^ nn-l.nnt E lll'l'--- • II E E {ll®Xik,--- ,lt®Xtk\ 



ii,--- ,it k ^i,--- 



< \h^- (22) 
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If we want W^Ek (pI " pD ® ipl)^')\\tr < l/p{n), t should be o{n). □ 
Our QPKE is information theoretic security, which is reahzed via a new 
pubhc-key algorithm structure. The security of the scheme in [sl is bounded 
information theoretic secure because it is based on a common public-key 
structure. 

4. Extended QPKE for Multibits 

We take a two-bit scheme as an example to show how to extend our QPKE 
to encrypt more than one bit with each pair of the public-key. 

4.I. Four States Used to Construct the Public-Key 
Definition 7. Define the n-qubit state as: 

\K,kJ = li\^) + \^®h) + \^®h) + \t(Bh(Bh)) 

= ^(1^1)1^2) + \ii © ^11)^2 © ku) + \ii © k2i)\i2 © ^22) 

+ \ii © ku © k2i)\i2 © ki2 © k22)), (23) 

where ki,k2,i G Z2n, 11,12 G Z^r^, kii,k22 G ki2,k2i G 1125, and i = 

{ii,i2), ki = {kii,ki2), k2 = (/c2i,/^22)- 

Applying (g) Z®t on l^^fc^^^^^j), we obtain: 

\K,kJ = + N ® ^1) - N ® ^2) - K © A:i © k2)). (24) 
Applying Z®? J® 5 on I^E^fc^^^^j), we obtain: 

\K,kJ = -\'® ^1) + 1^ ® ^2) - K © fci © ^2)). (25) 
Applying Z®" on |^E'fc%2 «)' obtain: 

= ^(K) - K ® ^1) - K ® ^2) + K © A:i © k2)). (26) 

Let the four states be the cipher text of two classical bits. We construct 
a two-bit oriented QPKE scheme based on them. 
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4 ■ 2. Trapdoor Property 

Suppose ki and k2 are given, for which without i the four mixed states are: 



00 



YnY.\'^lMMKM.l (27) 

i 



kiM On I^fci>fc2,«)(^fci,fc2,«l' (29) 



Pk 



PkiM 



4El*^i-^2.)(^i',fc2.l- (30) 



We take ^'^ example to explain that the algorithm described 

in Lemma [3] can also be used to distinguish these four states. The process 
includes the following steps: 

(1) Prepare two quantum registers, the first one contains two control bits 
in state |0)(0| ® |0)(0|, and the second one contains the unknown state. 
Take p^^^ ^ example, then the state of the system is 

|0)(0|®|0)(0|®p^°,^. (31) 

(2) Apply the Hadamard transformation to the first control bit and the 
controUed-fci operator to P^Im^ then the state of the system becomes 

^ E IV'fci,fc2,j)('^fcl,A:2,jl' (32) 



where 

WZkJ = ^ [|0)|0)(K) - \t © k,) + k^) -\i®k,® k^)) 

+ |l)|0)(|i © ki) - \i) - \i ®ki® k2) + fc2))](33) 
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(3) Apply the Hadamard transformation to the first control bit again, and 
the state of the system becomes 

|l)(l|®|0)(0|®pi°,^. (34) 

(4) It can be seen that if we perform operations H ® I ■ Ck2 ■ H ® I that is 
related to the second control bit, the final state of the system will be 

|l)(l|®|0)(0|®p^%^. (35) 

If the unknown state is one of the other three, the final state will be: 

|0)(0|®|0)(0|®p°%^, (36) 

or 

.01 



or 



0)(0|®|l)(l|®p^i,,^, (37) 



l)(l|®|l)(l|®pi;,,^. (38) 



We can distinguish between these four states by measuring the first reg- 
ister. 

4-3. Indistinguishahility Property 

Without fci, k2 and i, the ciphertext consists of four mixed states: 



00 
Podd 



Podd 



Podd 



Podd 



2 



2^ X] ^°i.fc2,i' (39) 



Iz-,T.p'Im.^ (40) 

fcl,fc2 



22n 



n-4 Pkl,k2,i^ ("^2) 



22n 

ki,k2 



where ki and ^2 satisfy definition [71 

We can prove that the trace distance between any two of the four states 
is Oij,). 
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(1) The trace distance between and p^^ is Dipl'^^^, pl^^^) = ^ (see 
Appendix A). 

(2) The trace distance between and p°^^ is /^(p^^^, p°dd) = ^ (see 
Appendix B). 

(3) The trace distance between p°°^ and p^l]^ is D{PoddJ Podd) = "^^^ 
proof is similar as that of -D(Po|]^, p°^^). 

(4) By the triangle inequality of the trace distance [ll|, we have 

^(PoL, pL) < D{pZ, Cd) + D{pZd. Pfdd) = (43) 

D{pZd, Pl'dd) < D{pZi, pZd) + D{pZi, p'^dd) = (44) 

^(pL, PoL) < ^(Po°d, pL) + ^(Podd, Podd) = (45) 

As shown in Figure |2l each trace distance between any two of these four 
states is 0{^). 




Figure 2: Trace distances between pj^"^ and other three states are ^„L^ , so the trace 
distances between any two states of the other three are no more than 

4.4- Extended QPKE for Two Bits 

To extend the QPKE scheme to the two-bit oriented one, two aspects will be 
modified: 
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(1) Bob chooses s G {0, 1}p°'2/(") randomly, satisfies F{s) = (fci, ^2), where 
ki,k2 are defined above. Bob generates the n-qubit state Pfc^ fc^,*' 
sends (s, J to the pubhc register as his pubhc-key. 

(2) Ahce encrypts 00 into 01 into p^,^^^, 10 into and 11 
into pllk^,,, with operations /®", /®5 ® Z®?, Z«^t (g) /®t and Z®'^ 
respectively. 

Because the trace distance of every pair of the four states is 0{^), the 
QPKE scheme satisfies Eq.([5]), so it is a scheme with information theoretic 
security under CPA. 

4.5. Extended QPKE for Multi Bits 

We now extend the QPKE to encrypt / bits. Define n-qubit state as: 

= 7^7 \^®^iki®X2k2---®Xih). (46) 

where fci, k2, - ■ ■ ,ki,i G Z2^, Xi, ■ ■ ■ ,xi G {0, 1}, each kj (j = 1, ■ ■ ■ , /) can 
be divided into 1 parts kj = {kji, ■ ■ ■ , kji), only Wnikjj) = odd, and others 
are even. 

We can use 

®((l-x,)J + x,Z)«?|<,o...^,^^J, (47) 

to represent classical bits {xi, ■ ■ ■ ,xi). If we use these 2' states to construct 
QPKE, the algorithm introduced in Lemma|3]can also be used for decryption. 
We conjecture that the trace distance of every pair of these mixed states is 
0(2^^^), then the extended scheme is also one with information theoretic 
security under CPA. 

5. Conclusions 

We have proposed a definition for the information theoretic security of a 
quantum public-key encryption scheme, and proved the sufficient condition 
that a QPKC scheme has information theoretic security if the trace distance 
between every pair of ciphertext states is less than l/p[n) for every posi- 
tive polynomial p(-). We present bit-oriented and two-bit-oriented QPKE 
schemes with a new algorithm structure, and prove that both of them sat- 
isfy our security definition. Finally, we extend the QPKE to the multi-bit- 
oriented case, and conjecture that the scheme is also one with information 
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theoretic security. The information theoretic security of our QPKE schemes 
depends directly on the new structure of the pubhc-key algorithm that we 
have introduced here. 



Acknowledgements 

This work was supported by the National Natural Science Foundation of 
China under Grant No. 60573051. 

References 

[11 T.Okamoto, K.Tanaka and S.Uchiyama (2000), Quantum Public-Key 
Cryptosystems, Crypto 2000, LNCS 1880, pp: 147-165. 

D.Gottesman and I.L.Chuang (2001), Quantum Digital Signatures, 
|quant-ph/0105032^ 

D.Gottesman (2005), Quantum Public Key Cryptography with 
Information- Theoretic Security, unpulished. 

L.Yang (2003), Quantum Public-Key Cryptosystem Based on Classical 



NP- Complete Problem, quant-ph/03l6o76] 



A.Kawachi, T.Koshiba, H.Nishimura and T.Yamakami (2005),Com]9'u- 
tational Indistinguishability Between Quantum States and Its Crypto- 
graphic Application, Eurocrypt 2005, LNCS 3494, 268-284. 

G.M.Nokolopoulos {2008), Applications of single-qubit rotations in 
quantum public-key cryptography, Phys. Rev. A, 77(3): 032348. 

A.Kawachi, T.Koshiba, H.Nishimura, and T.Yamakami (2006), Com- 
putational Indistinguishability between Quantum States and Its Cryp- 
tographic Application, Full version of |5|, |quant-ph70403069| 

M. Hayashi, A. Kawachi, H. Kobayashi (2008), Quantum measurements 
for hidden subgroup problems with optimal sample complexity. Quan- 
tum Inf. Comput., Vol.8, pp. 0345-0358. 

O.Goldreich (2004), Foundations of Cryptography: Basic Applications, 
Publishing House of Electronics Industry (Beijing). 



15 



[10] T.Koshiba (2007), Security Notions for Quantum Public-Key Cryptog- 
raphy, | quant-p h/0702183t 

[11] M.A.Nielsen and I.L.Chuang (2000), Quantum Computation and Quan- 
tum Information , Cambridge University Press (London). 

[12] C.A.Fuchs (1996), Distinguishability and Accessible Information in 
Quantum Theory, jquant-ph/9601020j 

[13] C.A.Fuchs (1997) ,Nonorthogonal Quantum States Maximize Classical 
Information Capacity, Phys. Rev. Lett., 79(6):1162-1165. 

[14] M.B.Ruskai (1994), Beyond strong subadditivity? improved 
bounds on the contraction of generalized relative entropy, 
Rev.Math.Phys.,6(5A):1147-1161. 

Appendix A. 

Trace Distance between p°J]^ and pl\^: 

Podd ~ Podd — 22n-4 . 2" ■ 4 i^iMki + -^i.iefe + + -^jefei,jefciefe2 




since 




and 




then 



Podd Podd 




k\,k2,i 



8 ■ 2 



,n-2 





1 



(A.4) 
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where the Aodd is the same as in (HM . according to (ITB]) we have 



D{pZd^ pI'm) = ltr\pZ - pI'J = ^;^=^tr\A,dd\ = (A.5) 



Appendix B. 

Trace Distance between and 

Podd ~ Podd — 22n-4 . 2" ■ 4 i'^i,i®k2 + Ei^iiSki(Bk2 + -E'ieA:i,jeA:2 + 

+ -£'jefci,iefciefc2 + -^jefc2,« + Ei^k2,i®k-i + Ei^kx®k2,i + Eii^kiS)k2,iiski) , (B.l) 
since 

Ei^iQ,k2 = EiQ,ki,i(Bki®k2 = Ei(^k2,i = EiQ,ki(Bk2,i(Bki ; (B-2) 

and 

i i i i 

then 

Podd ~ Podd 

22n-4 . 2" ■ 4 (-^«'«©'=2 + -^i,iefcieA:2) (B-4) 



k\,k2,i 



23n-2 



(-^n,iieA;2i ® Ei^^ir^^is^^ + -E'ii,jiefeiiefc2i ® -^i2,j2efci2eA:22)- 

*11''=12.'=21. 
*:22.n.«2 

Since = oc/rf, Vrff(^i2) = even, VrH'(/i;2i) = even and WH{k22) = 

odd, we have 

fell fell 

-^i2,i2efei2efe22 — -^i2,«2efc22- (-^-6) 

^22 ^22 



17 



then 



Podd P^odd 



— o-'i"-^ ^ -^il.iietel <^ -^12,120^22 + ^ -£"11,110^11^-^22^129^22) 

jl,«2 k21,k22 fcll,fc22 

~ 92n-3 ( -£n,nefe2i + -^ii.nefcii) ® ( ^ -^12,120^22) 



ii,fc2i 



iijfeii 



12,^22 



n— 3 2 ' 2 ' 



(B.7) 



where Aom,^ is a 22 x 22 matrix similar to Aodd, and 



An = 
2 



1 1 
1 1 



then we have 



tr\AiL\ = 2t, 



odd. 



22 
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